Data Processing Agreement.

01This agreement

This Data Processing Agreement (“DPA”) is between you, the business that uses Spaces (“you”), and SpacesOS Inc., 251 Little Falls Drive, Wilmington, New Castle County, Delaware (“Spaces”, “we”, “us”).

It applies when Spaces processes personal data on your behalf while providing the service, and the UK GDPR, the EU GDPR or a similar data protection law applies to that processing. It forms part of our terms. If this DPA and the terms disagree about personal data, this DPA applies.

02Who is responsible for what

For the personal data in your connected accounts, you are the controller and Spaces is your processor. You decide why and how that data is used. We use it only to provide Spaces to you, following your documented instructions.

Your instructions are these terms and this DPA, the settings you choose, and what you, your team or your AI agent ask Spaces to do through the dashboard, the API or the MCP server. If we believe an instruction breaks data protection law, we will tell you.

For the details we hold to run your own Spaces account, such as your sign-in email and billing records, Spaces is the controller. Our privacy policy covers that data.

03Purpose and duration

We process personal data to provide Spaces: to connect your accounts, read and send messages, posts and comments when you or your agent ask, run scheduled messages and routines, keep each account inside its limits, and support you. We do not sell it, use it for advertising or use it to train AI models.

We process it for as long as you use Spaces, and then until it is deleted as described in section 11.

04The personal data involved

The people concerned are your customers and contacts, the people your AI agent talks to on your behalf, and the members of your team. The categories of data are:

• Contacts: names, handles, phone numbers, email addresses and the profile details a platform shows.
• Message content: messages, photos, files, comments and posts sent or received on your connected accounts.
• Account metadata: details of connected accounts, times, delivery and read status, tags, owners and notes, and records of actions taken with your keys.

Spaces is not designed for special category data, such as health information. If your customers send it in a message, you remain responsible for handling it lawfully, and we protect it in the same way as all other message content.

05What Spaces commits to

• Process personal data only on your instructions, unless the law requires otherwise, in which case we will tell you first where the law allows.
• Make sure everyone at Spaces who can access the data is bound to keep it confidential.
• Keep appropriate technical and organisational security measures in place (section 6).
• Help you, as far as we reasonably can, to answer requests from people exercising their rights, and with data protection impact assessments and consultations with regulators.
• Keep records of the processing we carry out for you.

06Security

We protect personal data with measures suited to the risk. They include HTTPS for the site, dashboard, API and MCP server, keys stored only as one-way hashes, hashed passwords, two-step sign-in, roles that limit what each person can do, an audit log of important changes, and a copy of messages that is kept for 90 days at most. The security page describes them in full, and we may improve them over time without lowering the overall level of protection.

07Sub-processors

Spaces uses a small number of sub-processors to provide the service, for hosting, for connecting messaging accounts and for sending email. You give us general permission to use them.

We give the current list on request: email hello@spacesos.com. We will tell you by email before we add or replace a sub-processor, so you have time to object on reasonable data protection grounds. If we cannot resolve the objection, you may stop using the affected part of the service.

Each sub-processor is bound by a written contract with data protection terms that protect personal data at least as well as this DPA. We remain responsible to you for their work.

08International transfers

Spaces is a United States company, and personal data may be processed in the United States and other countries. Where UK or EU law requires safeguards for a transfer, we rely on the standard contractual clauses approved for that purpose, with the UK addendum to them where UK law applies, or another lawful transfer mechanism.

09Personal data breaches

If we become aware of a personal data breach affecting your data, we will tell you without undue delay. We will share what we know, what data and people are affected, what we have done to contain it, and how to reach us, and we will add detail as we learn more. We will help you meet your own duties to notify regulators and the people affected.

10Requests from individuals

If someone contacts Spaces directly to access, correct or delete personal data we process for you, we will pass the request to you and not answer it ourselves unless you ask us to. We will help you respond, for example by deleting a contact’s data when you ask.

11Deletion or return at the end

When you close your workspace, or ask for your data to be deleted, we delete the personal data we process for you, including copies in backups and logs, unless the law requires us to keep some of it. Before you close your workspace you can ask us by email for a copy of the data we still hold. The data deletion page explains how a request works and gives you a status page.

Day to day, messages leave Spaces’ copy after 90 days, and disconnecting an account removes its copy at once. Messages already delivered stay in the other person’s app, and we cannot delete those.

12Audits

On request, we will give you the information you reasonably need to show that we meet this DPA. If that is not enough, you, or an independent auditor bound by confidentiality, may audit our compliance once a year with at least 30 days’ notice, at your own cost, in a way that does not disrupt the service or expose other customers’ data. A regulator may audit whenever the law allows.

13How to sign

This DPA applies to your use of Spaces as part of the terms. If your business needs a signed copy for its records, email hello@spacesos.com with your company’s legal name, address and the name of the person signing. We will send a copy for signature and return it countersigned.

14Contact

SpacesOS Inc., 251 Little Falls Drive, Wilmington, New Castle County, Delaware. Questions about this DPA or data protection: hello@spacesos.com.

15Common questions